# scan.mx

> Free email deliverability and DNS diagnostics. Check MX, SPF, DKIM, DMARC, DNSSEC, MTA-STS, blacklists, and live SMTP for any domain, with a letter grade and RFC references.

scan.mx checks the email configuration of a domain the user supplies. Each report is a shareable permalink at https://scan.mx/<domain>. No account, no signup, no API key. Reports are cached up to 30 days; the Re-scan button forces a fresh scan.

## What it checks

- MX records: presence, hostnames, resolution, null-MX
- SPF: presence, syntax, all-qualifier, 10-lookup limit
- DKIM: signing keys at common and custom selectors
- DMARC: policy strength (none/quarantine/reject) and reporting
- DNS health, DNSSEC delegation, and detected mail provider
- Blacklists: Spamhaus ZEN, DBL, ZRD, AuthBL, SpamCop, GBUdb Truncate, PSBL
- Live SMTP probe of the MX hosts (asynchronous, via a dedicated prober), including REQUIRETLS (RFC 8689) and LIMITS (RFC 9422) support

## Scoring

Each report gets a 0 to 100 score and an A+ to F letter grade. Specific weaknesses cap the grade however good the rest of the setup is: no MX or a confirmed open relay caps at F; a soft SPF all-qualifier, an MX that resolves to nothing, or having neither SPF nor DMARC caps at D; a missing SPF or DMARC record, or no STARTTLS, caps at C; DMARC p=none or an enforcing policy left in t=y test mode, unprotected subdomains, SPF past the 10-lookup limit, or an expired/mismatched MX certificate caps at B. A+ needs DMARC p=reject with aggregate reporting, MTA-STS in enforce mode, and a valid DANE binding.

## API

Free anonymous HTTP API, no key.

- GET https://api.scan.mx/v1/check?domain=example.com - full JSON report
- GET https://api.scan.mx/v1/check/stream?domain=example.com - Server-Sent Events for the live SMTP probe
- https://api.scan.mx/ - API documentation
- https://api.scan.mx/openapi.json - OpenAPI 3 spec

Rate-limited per IP and per (IP, domain) for abuse prevention. HTTP 429 with Retry-After when limited.

## MCP

Model Context Protocol server at https://api.scan.mx/mcp (Streamable HTTP transport). Tools: check_domain, check_mx, check_spf, check_dmarc, check_dkim, check_blacklist, check_mta_sts, check_dnssec, check_bimi. No key. Docs: https://mcp.scan.mx/

## Tool pages

- https://scan.mx/mx-lookup - MX record lookup
- https://scan.mx/spf - SPF checker
- https://scan.mx/dkim - DKIM checker
- https://scan.mx/dmarc - DMARC checker
- https://scan.mx/blacklist - blacklist (DNSBL) check
- https://scan.mx/mta-sts - MTA-STS policy check
- https://scan.mx/dnssec - DNSSEC check
- https://scan.mx/bimi - BIMI record, logo and VMC check

## Opt-out

Domain owners can block scanning of their domain by publishing a DNS TXT record at optout.<domain> naming scan.mx. One record can name several services, separated by spaces or commas ("scan.mx, ssltest.com"); each service reads its own name. See https://scan.mx/optout

## Contact

- Abuse: abuse@scan.mx
- Privacy / data subject requests: privacy@scan.mx
- Operator: Fili Wiese, Berlin, Germany, https://fili.com